#!/usr/bin/nft -f

# IPv4/IPv6 Simple & Safe firewall ruleset.
# More examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples/.

# some codes from:
# https://wiki.archlinux.org/title/Nftables
# https://www.procustodibus.com/blog/2021/11/wireguard-nftables

# needed for reload config using `sudo systemctl restart nftables` or `sudo nft -f /etc/nftables.conf`
flush ruleset

define pub_iface = "enp2s0"
define wg_iface = "wg_studio"
table inet my_table {

	chain my_input {
		type filter hook input priority filter
		policy drop

		ct state invalid drop comment "early drop of invalid connections"
		ct state {established, related} accept comment "allow tracked connections"
		iifname lo accept comment "allow from loopback"
		iifname $wg_iface accept comment "allow from wireguard"
		ip protocol icmp accept
		meta l4proto ipv6-icmp accept

		tcp dport ssh accept
		#udp dport mdns accept
		#tcp dport qbt-nox accept
		tcp dport qbt accept
		udp dport qbt accept
		#tcp dport iperf3 accept
		udp dport wireguard accept

		pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited
		counter comment "count any other traffic"
	}

	chain my_forward {
		type filter hook forward priority filter
		policy drop
		# Drop everything forwarded to us. We do not forward. That is routers job.

		# needed for wireguard?
		#iifname $wg_iface oifname $pub_iface accept
		#iifname $pub_iface oifname $wg_iface accept
		iifname $wg_iface accept
		oifname $wg_iface accept
	}

	chain my_output {
		type filter hook output priority filter
		policy accept
		# Accept every outbound connection
	}
}

# https://wiki.gentoo.org/wiki/Nftables/Examples#Basic_NAT
# needed by wireguard?
# Need inet to masquerade both ipv4 and ipv6? If use ip it will only masquerade ipv4? If use ip6 it will only masquerade ipv6?
# https://wiki.nftables.org/wiki-nftables/index.php/Nftables_families
table inet nat {
	chain prerouting {
		type nat hook prerouting priority 0; policy accept;
	}

	# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
	chain postrouting {
		type nat hook postrouting priority 100; policy accept;
		oifname $pub_iface masquerade
	}
}